Digital Forensics

Unit 1

Introduction - Evidential potential of digital devices: closed vs. open systems, evaluating digital evidence potential- Device handling: seizure issues, device identification, networked devices and contamination. Overview of Types of computer forensics i.e. Media Forensics, Network forensics (internet forensics), Machine forensic, Email forensic (e-mail tracing and investigations)

Unit 2

Digital forensics examination principles: Previewing, imaging, continuity, hashing and evidence locations- Seven element security model- developmental model of digital systems- audit and logs- Evidence interpretation: Data content and context.

Unit 3

Live Data collection and investigating windows environment: windows Registry analysis, Gathering Tools to create a response toolkit (Built in tools like netstat, cmd.exe, nbtstat, arp, md5sum, regdmp etc and tools available as freeware like Fport, Pslist etc), Obtaining volatile Data (tools like coffee, Helix can be used) Computer forensics in windows environment, Log analysis and event viewer, File auditing, identifying rogue machines, hidden files and unauthorized access points

Unit 4

Live Data collection and investigating Unix/Linux environment: /Proc file system overview, Gathering Tools to create a response toolkit (Built in tools like losetup, Vnode, netstat, df, md5sum, strace etc and tools available as freeware like Encase, Carbonite etc). Handling Investigations in Unix/Linux Environment: Log Analysis (Network, host, user logging details), Recording incident time/date stamps, Identifying rogue processes, unauthorized access points, unauthorized user/group accounts,

Unit 5

Forensic Tools and Report Generation: Recovery of Deleted files in windows and Unix, Analyzing network traffic, sniffers, Ethical Hacking, Hardware forensic tools like Port scanning and vulnerability assessment tools like Nmap, Netscan etc. Password recovery (tools like John the ripper, L0phtcrack, and THC-Hydra), Mobile forensic tools and analysis of called data record Template for computer forensic reports